chore(deps): bump github/codeql-action from 3.25.15 to 3.26.0 #224
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.15 to 3.26.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@afb54ba...eb055d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
WalkthroughThe recent changes involve updates to GitHub Actions workflow configurations in two files: Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (2)
- .github/workflows/code-ql.yml (1 hunks)
- .github/workflows/scorecards.yml (1 hunks)
Files skipped from review due to trivial changes (1)
- .github/workflows/code-ql.yml
Additional comments not posted (1)
.github/workflows/scorecards.yml (1)
36-36: Verify the impact of the new version ofgithub/codeql-action/upload-sarif.The version of the
github/codeql-action/upload-sarifaction has been updated. Ensure that the new version does not introduce any breaking changes or require additional configuration.Verification successful
Verify the impact of the new version of
github/codeql-action/upload-sarif.The version of the
github/codeql-action/upload-sarifaction has been updated. Ensure that the new version does not introduce any breaking changes or require additional configuration, specifically:
- Check if the workflow involves Swift analysis on Ubuntu runners.
- Verify the CodeQL bundle version used in the workflow meets the new minimum requirement of
2.13.5.
Verify the impact of the new version of
github/codeql-action/upload-sarif.The version of the
github/codeql-action/upload-sarifaction has been updated. Ensure that the new version does not introduce any breaking changes or require additional configuration, specifically:
- The workflow does not involve Swift analysis on Ubuntu runners.
- Verify that the CodeQL bundle version used in the workflow meets the new minimum requirement of
2.13.5.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the impact of the new version of `github/codeql-action/upload-sarif`. # Test: Check the changelog for the new version. Expect: No breaking changes or additional configuration required. curl -s https://raw.githubusercontent.com/github/codeql-action/main/CHANGELOG.md | grep -A 10 '## [3.26.0]'Length of output: 43125
Script:
#!/bin/bash # Description: Check if the workflow involves Swift analysis on Ubuntu runners and verify the CodeQL bundle version. # Check if Swift analysis is included in the workflow grep -i 'swift' .github/workflows/scorecards.yml # Check the CodeQL bundle version used in the workflow grep -i 'codeql' .github/workflows/scorecards.ymlLength of output: 187
dependabot
bot
deleted the
dependabot/github_actions/github/codeql-action-3.26.0
branch
|
🎉 This PR is included in version 1.25.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
Bumps github/codeql-action from 3.25.15 to 3.26.0.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
eb055d7Merge pull request #2410 from github/update-v3.26.0-c24926b733884d04Update changelog for v3.26.0c24926bMerge pull request #2407 from github/dependabot/npm_and_yarn/npm-7954a73ad268ba39bMerge branch 'main' into dependabot/npm_and_yarn/npm-7954a73ad28dd1773Merge pull request #2408 from github/henrymercer/deprecate-codeql-2.13.4441c9d9Merge pull request #2409 from github/henrymercer/fix-required-checksf03da13Exclude push-only unit tests job from required PR checks script29a5cfcBump version to 3.26.09e440adAdd changelog note136f5a5Add CodeQL v2.17.6 to default test versionsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)